URL:

https://hostomo.com/app/step1

Full analysis: https://app.any.run/tasks/61aa7d7c-63cf-4d48-bc00-d20d011d5699
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: November 20, 2023, 14:29:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
lumma
stealer
Indicators:
SHA1:

4FA0796C7B9D3D3838BCE067FF6C226B92FF2BF4

SHA256:

A80B5446305A193B30093904A6286C261A45FFF7F837E94F7BF4C98D2D61F74E

SSDEEP:

3:N82WsITo+:22WsIF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 5560)
      • Updatе.exe (PID: 4908)

    • LUMMA has been detected (SURICATA)

      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 5560)
      • Updatе.exe (PID: 4908)

    • Actions looks like stealing of personal data

      • Updatе.exe (PID: 5560)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 4908)
      • Updatе.exe (PID: 5928)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4908)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 5560)

    • Reads browser cookies

      • Updatе.exe (PID: 5928)

    • Searches for installed software

      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 4908)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 4088)
      • WinRAR.exe (PID: 5372)
      • Updatе.exe (PID: 5560)

    • Checks supported languages

      • wmpnscfg.exe (PID: 4088)
      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4908)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 5560)

    • Reads the computer name

      • wmpnscfg.exe (PID: 4088)
      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 4908)
      • Updatе.exe (PID: 5560)

    • The process uses the downloaded file

      • chrome.exe (PID: 4876)
      • chrome.exe (PID: 4216)
      • chrome.exe (PID: 5272)
      • chrome.exe (PID: 5092)
      • chrome.exe (PID: 5532)
      • chrome.exe (PID: 5544)
      • WinRAR.exe (PID: 5840)
      • chrome.exe (PID: 6056)
      • WinRAR.exe (PID: 5372)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 5236)
      • chrome.exe (PID: 5468)
      • chrome.exe (PID: 5500)
      • chrome.exe (PID: 968)
      • WinRAR.exe (PID: 5840)
      • WinRAR.exe (PID: 5372)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 4088)
      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 4908)
      • Updatе.exe (PID: 5560)

    • Application launched itself

      • chrome.exe (PID: 3428)

    • Checks proxy server information

      • Updatе.exe (PID: 5928)
      • Updatе.exe (PID: 4228)
      • Updatе.exe (PID: 4908)
      • Updatе.exe (PID: 5560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
92
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmpnscfg.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs #LUMMA updatе.exe chrome.exe no specs chrome.exe no specs #LUMMA updatе.exe #LUMMA updatе.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs #LUMMA updatе.exe

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5932 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
292"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6280 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
328"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4580 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
564"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=4384 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
664"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3332 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
732"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5524 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3852 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
880"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=5548 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2136 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6660 --field-trial-handle=1160,i,4749186342194719111,2726581821117538757,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
11 260
Read events
10 977
Write events
280
Delete events
3

Modification events

(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
1
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3428) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
(PID) Process:(3428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_enableddate
Value:
0
Executable files
9
Suspicious files
114
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1676da.TMP —
MD5:—
SHA256:—
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC
SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old~RF1678ee.TMPtext
MD5:7C1C23F006788D107F8A01B852CC6701
SHA256:9FA4E627077EDCBEC8AAA1ED2DD5538E630790893F88F02F1E9CC863E6A27848
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:513218482935B0D388C0A990D868387A
SHA256:8E39CBAAF4AACC3A01AFA74EA8C30FB24FE69A22B8B30728AFB1614FD68809D9
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.oldtext
MD5:29B82603A20A26A3F99DB34525AF7448
SHA256:9601A054A9C6AA6A65CEFAA229046476C1A089989FA6441DAD71D39F6794B980
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF167871.TMPtext
MD5:99EC94B2503FAD33EDAF99779EBA5BC8
SHA256:DC554AB7EDCAD375F39ED106CA1EF9A89FB8D9063A4D08F377F2C80D66799D7E
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOG.old~RF168cd3.TMP —
MD5:—
SHA256:—
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOG.old —
MD5:—
SHA256:—
3428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOG.old~RF168cd3.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
145
TCP/UDP connections
562
DNS requests
537
Threats
164

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
2 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
5928
Updatе.exe
POST
200
188.114.97.3:80
http://varshavlur.pw/api
unknown
text
21 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3608
chrome.exe
172.217.16.205:443
accounts.google.com
GOOGLE
US
whitelisted
3428
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
3608
chrome.exe
172.67.158.86:443
hostomo.com
CLOUDFLARENET
US
unknown
3608
chrome.exe
104.20.139.65:443
tinyurl.com
CLOUDFLARENET
—
unknown
3428
chrome.exe
224.0.0.251:5353
—
—
—
unknown
3608
chrome.exe
142.250.184.228:443
www.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
accounts.google.com
  • 172.217.16.205
shared
hostomo.com
  • 172.67.158.86
  • 104.21.82.139
unknown
tinyurl.com
  • 104.20.139.65
  • 104.20.138.65
  • 172.67.1.225
shared
www.google.com
  • 142.250.184.228
  • 142.250.186.68
  • 172.217.16.132
whitelisted
a.pub.network
  • 104.18.20.206
  • 104.18.21.206
whitelisted
cdn.jsdelivr.net
  • 104.16.88.20
  • 104.16.89.20
  • 104.16.85.20
  • 104.16.86.20
  • 104.16.87.20
whitelisted
fonts.googleapis.com
  • 142.250.186.170
whitelisted
fonts.gstatic.com
  • 142.250.186.67
whitelisted
d.pub.network
  • 34.160.152.31
whitelisted
optimise.net
  • 34.111.152.239
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
5928
Updatе.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5928
Updatе.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In
5928
Updatе.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
5928
Updatе.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5928
Updatе.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration
5928
Updatе.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Exfiltration
5928
Updatе.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5928
Updatе.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5928
Updatе.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
10 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://hostomo.com/app/step1